EP2650698B1 - Improvement of the integrity concept of a satellite navigation system - Google Patents

Description

The invention relates to a method and a device for determining the integrity risk at an alarm barrier of a position solution determined by a satellite navigation system according to claim 1 or 7.

Integrity is becoming increasingly important for satellite navigation systems, especially for safety-critical applications such as satellite navigation-based air navigation. One concept for providing integrity in a satellite navigation system is to continuously monitor the satellites from the ground and to transmit data on the monitored satellites, for example, with the navigation signals radiated by the satellites, to usage systems of the satellite navigation system. A usage system can be enabled by this data to calculate its individual integrity risk and, for example, issue a warning or cancel a navigation operation or not even begin.

Above all, the data for the monitored satellites can be statistical descriptions of characteristics of the signals emitted by the satellites SIS (Signal-In-Space). In particular, the statistical descriptions may relate to distributions of SIS errors so that a utilization system can estimate an integrity risk based on this distribution.

For example, in the future European satellite navigation system, Galileo, an integrity data stream will be available that will allow system or satellite failures to be signaled to utilization systems. In particular, faulty satellite signals can be provided with integrity warnings (system warning mechanism). It is also intended to provide statistical descriptions of SIS properties with the integrity data stream so that use systems can determine their integrity risk (user integrity concept).

The concept of integrity of Galileo and its main features are described in the publication " The Galileo Integrity Concept, V. Oehler, F. Luongo, J.- P. Boyero, R. Stalford, HL Trautenberg, ION GNSS 17th International Technical Meeting of the Satellite Division, 21-24 Sept. 2004, Long Beach, CA. in the published European patent application EP 1 637 899 A1 and the granted European patent EP 1 792 196 B1 described in detail. In the following, useful details of the Galileo integrity concept will be explained again for the understanding of the present invention.

The Galileo Integrity Concept foresees that Galileo's Ground Processing Segment will predict the accuracy of navigation signals. This prediction is a statistical description of the signal error and is referred to as expected signal error or In Space Accuracy (SISA) signal.

The actual errors of the individual satellite signals or Signal In Space Errors (SISE) are estimated by observations of the monitoring network of the Galileo system. The estimated errors are referred to as estimated SISE (eSISE).

Under the Galileo Integrity Concept, it is now envisaged that a satellite over an IF (Integrity Flag) alarm will be set to unusable as soon as the estimated signal error (eSISE) of that satellite is greater than an Integrity Alarm Threshold (TH: Threshold). Such alerts are transmitted to Galileo's usage systems as system alerts.

Since the eSISE estimate of the SISE is an error-prone process, it is generally assumed that the distribution of the current SISE can be described by the value of the estimated SISE eSISE with a Gaussian distribution with the standard deviation, which can be used as Signal-In-Space Monitoring. Accuracy (SISMA). SISMA therefore provides a statistical description of the accuracy of the eSISE estimate of the SISE for a satellite.

In the Galileo integrity concept, it is planned to transfer the two statistical descriptions SISA and SISMA to utilization systems, which then use these values to calculate their individual integrity risk within the framework of the user integrity concept.

• Zustand 1: Der Satellit ist fehlerfrei und auch die statistische Beschreibung des fehlerfreien Satelliten ist korrekt. Das bedeutet im Fall von Galileo, dass der Fehlerwahrscheinlichkeitsverteilung des Satelliten durch den SISA-Wert von Galileo overbounded wird.
• Zustand 2: Der Satellit ist fehlerbehaftet und bezüglich der statistischen Beschreibung des fehlerhaften Satelliten wird angenommen, dass der Satellit einen positiven oder negativen Grundfehler der Größe TH hat, sich der gesamte Fehler aus dem Grundfehler und einem Zusatzfehler zusammensetzt, und im Fall von Galileo die Wahrscheinlichkeitsverteilung des Zusatzfehlers durch den SISMA-Wert von Galileo overbounded wird. Beim Galileo-Integritätskonzept wird der Grundfehler bzw. die Integritätsalarmschranke TH als ein Produkt eines Vorfaktors und der Wurzel der Summe der Quadrate von SISA und SISMA wie folgt berechnet: $$\mathit{TH}=k_{\mathit{pfa}}\cdot \sqrt{{\mathit{SISA}}^2+{\mathit{SISMA}}^2}$$
  

For the Galileo integrity concept and integrity risk calculation, it is now assumed for each satellite that a satellite is in one of the following states:

• Condition 1: The satellite is error free and also the statistical description of the error free satellite is correct. This means in the case of Galileo that the satellite's probability of error distribution is overbounded by Galileo's SISA value.
• State 2: The satellite is faulty, and for the statistical description of the faulty satellite, it is assumed that the satellite has a positive or negative fundamental error of magnitude TH, the total error is composed of the fundamental error and an additional error, and in the case of Galileo the probability distribution of the additional error is overbounded by the SISMA value of Galileo. In the Galileo integrity concept, the fundamental error or integrity alarm threshold TH is calculated as a product of a pre-factor and the root of the sum of the squares of SISA and SISMA as follows: $$\mathit{TH}=k_{\mathit{pfa}}\cdot \sqrt{{\mathit{SISA}}^2+{\mathit{SISMA}}^2}$$
  

The prefactor k _pfa is determined by the allowed false alarm rate.

As a user-integrity concept, the calculation of the integrity risk at a so-called alarm barrier AL has proven to be practicable for Galileo (for the horizontal and vertical case, different alarm barriers HAL and VAL are considered here). For this, it is assumed that either all n satellites using a usage system are in state 1, or all but one satellite are in state 1 and one satellite is in state 2 only.

Integrity risk is now considered to be the weighted average of the n + 1 possible states (n states 2 where each of the n satellites is assumed to be in state 2 and 1 state 1 where all satellites are considered to be in state 1) For simplicity, the weight for the state in which all satellites are in state 1 is often assumed to be 1 and the weight for each of the n states in which one satellite is in state 2 is assumed to be p_failed Is accepted. The integrity risk from the other possible states of the system is taken into account with a constant additive term in the integrity risk at the alarm gate. With large SISMA, however, this leads to a reduced availability.

The EP 2 402 785 A1 discloses a RAIM algorithm for determining an integrity risk in a GNSS by processing a plurality of signals received from satellites of the GNSS with the following actions: determining multiple health risks on an alarm barrier for different error states of the signals, and determining an overall integrity risk at the alarm barrier from the determined plurality of integrity risks ,

It is now an object of the present invention, on the basis of the integrity concept explained above, to increase the availability of a position solution determined with a satellite navigation system with an integrity risk at an alarm barrier.

This object is achieved by a method and a device for determining the integrity risk at an alarm barrier from a position solution determined by means of a satellite navigation system having the features of claims 1 and 7, respectively. Further embodiments of the invention are the subject of the dependent claims.

In order to increase the availability of a position solution with a satellite navigation system with an integrity risk at an alarm gate, according to the invention the unweighted contribution to integrity risk at the alarm gate is calculated under two different assumptions, assuming that satellite j is faulty, and the minimum used both calculated contributions. The first integrity risk at the alarm gate is calculated using the classic and initial assumptions that satellite j is assumed to be state 2. The second integrity risk at the alarm gate is calculated as follows: the difference between the position solution with all satellites and the position solution with the satellite j removed from the position solution is subtracted from the alarm gate, and then the integrity risk with the n-1 satellites passing through Condition 1, calculated at the reduced alarm limit.

• Berechnen eines ersten Integritätsrisikos an der Alarmschranke unter der Annahme, dass ein Satellit j der Satelliten fehlerbehaftet ist;
• Ermitteln einer ersten Positionslösung mit den von allen Satelliten empfangenen Signalen;
• Ermitteln einer zweiten Positionslösung mit den von allen Satelliten empfangenen Signalen außer dem vom Satelliten j empfangenen Signal;
• Ermitteln einer Differenz zwischen der ersten und der zweiten Positionslösung;
• Bilden einer reduzierten Alarmschranke durch Subtrahieren der ermittelten Differenz von der Alarmschranke;
• Berechnen eines zweiten Integritätsrisikos an der reduzierten Alarmschranke mit den von allen Satelliten empfangenen Signalen außer dem vom Satelliten j empfangenen Signal; und
• Ermitteln des Integritätsrisikos an der Alarmschranke unter Verwendung des Minimums des ersten und des zweiten Integritätsrisikos.

An embodiment of the invention now relates to a method for determining the integrity risk at an alarm barrier from a position solution determined by a satellite navigation system, where signals received from satellites of the satellite navigation system are processed to determine the position solution and the method is characterized by the following steps:

• Calculating a first integrity risk at the alarm barrier assuming that a satellite j of the satellites is faulty;
• Determining a first position solution with the signals received from all the satellites;
• Determining a second position solution with the signals received from all the satellites other than the signal received from the satellite j;
• Determining a difference between the first and second position solutions;
• Forming a reduced alarm barrier by subtracting the determined difference from the alarm barrier;
• Calculating a second integrity risk at the reduced alarm barrier with the signals received from all the satellites other than the signal received from the satellite j; and
• Determine the integrity risk at the alarm barrier using the minimum of the first and second integrity risk.

The integrity risk at the alarm barrier can be identified, in particular using the minimum of the first and the second integrity risk, as an unweighted contribution according to the User Integrity Concept of the Galileo satellite navigation system.

Furthermore, statistical descriptions of signal errors of each satellite provided by the satellite navigation system can be processed by determining therefrom for a faulty satellite a fundamental error which is evaluated as faulty for the classification of a satellite.

wobei der Vorfaktor k_pfa durch eine erlaubte Falschalarmrate bestimmt wird.As statistical descriptions regarding signal errors of each satellite can
the expected signal error or Signal In Space Accuracy SISA value for each satellite signal and
the accuracy of the signal error estimation or the Signal-in-Space-Monitoring-Accuracy SISMA value for each satellite signal
are processed by calculating, for each satellite, the fundamental error TH according to the following equation: $$\mathit{TH}=k_{\mathit{pfa}}\cdot \sqrt{{\mathit{SISA}}^2+{\mathit{SISMA}}^2}$$

wherein the prefactor k _{pfa is} determined by an allowable false alarm rate.

A further embodiment of the invention relates to a computer program with program code for carrying out all method steps according to the invention and as described above, when the computer program is executed in a computer.

Furthermore, an embodiment of the invention relates to a data carrier on which the computer-executable program code of the computer program according to the invention and as described above is stored.

In a further embodiment, the invention relates to a device for determining the integrity risk at an alarm barrier from a position solution determined by a satellite navigation system, wherein the device for processing signals received from satellites of the satellite navigation system is designed to determine the position solution and is characterized by first means for calculating a first integrity risk at the alarm barrier assuming that a satellite j of the satellites is faulty,
second means for determining a first position solution with the signals received from all the satellites,
third means for determining a second position solution with the signals received by all the satellites other than the signal received by the satellite j,
fourth means for determining a difference between the first and second position solutions,
fifth means for forming a reduced alarm barrier by subtracting the determined difference from the alarm barrier,
sixth means for calculating a second integrity risk at the reduced alarm barrier with the signals received from all the satellites other than the signal received from the satellite j and
seventh means for determining the integrity risk at the alarm barrier using the minimum of the first and second integrity risks.

The first to seventh means may be implemented, at least in part, by a programmable processor and a program stored in a memory for configuring the programmable processor to perform one or more steps of a method according to the invention and as described above.

Finally, an embodiment of the invention relates to a position determining device for determining a position based on signals of a satellite navigation system and for determining an integrity risk at an alarm gate for the determined position, wherein the A position determining device comprises an apparatus for determining the integrity risk at an alarm barrier from a position solution according to the invention determined by a satellite navigation system and as described above and having an output means for outputting a determined integrity risk.

The dispensing means may in particular comprise one or more of the following means: a display device; a data output interface; an audio output unit.

Further advantages and possible applications of the present invention will become apparent from the following description in conjunction with the embodiments illustrated in the drawings.

In the description, in the claims, in the abstract and in the drawings, the terms and associated reference numerals used in the list of reference numerals recited below are used.

• Fig. 1 ein Flussdiagramm eines Ausführungsbeispiels eines Verfahrens zum Ermitteln des Integritätsrisikos an einer Alarmschranke von einer mit einem Satellitennavigationssystem ermittelten Positionslösung gemäß der Erfindung; und in
• Fig. 2 ein Blockschaltbild einer Positionsbestimmungsvorrichtung gemäß der Erfindung, die Signale von vier Satelliten eines Satellitennavigationssystems empfängt und zur Positionsbestimmung auswertet.

The drawings show in

• Fig. 1 a flowchart of an embodiment of a method for determining the integrity risk at an alarm barrier from a position solution determined by a satellite navigation system according to the invention; and in
• Fig. 2 a block diagram of a positioning device according to the invention, the signals from four satellites of a satellite navigation system receives and evaluates for determining position.

In the following description, identical, functionally identical and functionally connected elements may be provided with the same reference numerals. Absolute values are given below by way of example only and are not to be construed as limiting the invention.

Fig. 1 shows in a flow chart the sequence of the method according to the invention for determining the integrity risk at an alarm barrier from a position solution determined using a satellite navigation system. The individual steps of the method will now be described in connection with the in Fig. 2 in which a position determining device 26, for example an aircraft navigation device, receives signals 340, 360, 380 and 400 from four satellites 34, 36, 38 and 40, respectively, of a satellite navigation system such as Galileo and for determining the position and determining an integrity risk processed an alarm barrier.

The signals 340, 360, 380 and 400 transmit the usual data provided by satellite navigation systems for position determination, such as transmission time, orbital data of the transmitting satellite, ephemeris of all satellites, etc. Further, as with Galileo integrity data such as SISA and SISMA, the satellite signals are transmitted in an integrity data stream with the signals.

The position determining device 26 includes a (not explicitly shown) receiver for the signals 340, 360, 380 and 400, which decodes the data transmitted with the signals in the usual and known manner and for further processing, in particular for position determination by a (not provided) controller provided. The controller is for this purpose configured to determine the current position of the device 26 based on the data. The position thus determined is referred to as a positional solution in the context of the present invention.

Furthermore, the device 26 has a device 10 for determining the integrity risk at an alarm barrier. The device 10 may, for example, be implemented in hardware in the form of an integrated circuit, or by a programmable processor configured by software implementing the method according to the invention is that he can determine the integrity risk at an alarm barrier according to the invention. The device can in principle also be realized by the controller, which is provided for the determination of the position solution. In this case, for example, a firmware of the position determination device 26 may be designed such that it contains additional functions for determining the integrity risk at an alarm barrier.

The device 10 implements several functions of an algorithm for determining the integrity risk at an alarm gate, which will now be described with reference to FIG Fig. 1 shown flowchart is described.

wobei der Vorfaktor k_pfa durch eine erlaubte Falschalarmrate bestimmt wird. Als fehlerbehafteter Satellit kann dann der Satellit mit dem größten Grundfehler ausgewählt werden.The algorithm determines in step S10 a satellite j, which is assumed to be faulty, that is, in the initially described state 2 according to the Galileo integrity concept. For further explanation, it is assumed that the satellite 36 is assumed to be faulty. To classify a satellite as having errors, for example, the SISA and SISMA values can be evaluated, which are determined by the ground segment of the satellite navigation system and transmitted with the integrity data stream. For example, based on the SISA and SISMA values for each satellite, the corresponding fundamental error TH is calculated according to the following equation: $$\mathit{TH}=k_{\mathit{pfa}}\cdot \sqrt{{\mathit{SISA}}^2+{\mathit{SISMA}}^2}$$

wherein the prefactor k _{pfa is} determined by an allowable false alarm rate. The satellite with the largest basic error can then be selected as the faulty satellite.

Then, assuming the faulty satellite 36, the algorithm calculates a first integrity risk PHMI (AL) at a predetermined alarm threshold AL, which may be, for example, at step S12 in particular, can be specified by a user depending on the application in which the position solution is to be used. The integrity risk can be calculated according to the Galileo user integrity concept explained in the introduction, as described in the publication " The Galileo Integrity Concept, V. Oehler, F. Luongo, J.- P. Boyero, R. Stalford, HL Trautenberg, ION GNSS 17th International Technical Meeting of the Satellite Division, 21-24 Sept. 2004, Long Beach, CA. in the published European patent application EP 1 637 899 A1 and the granted European patent EP 1 792 196 B1 is described in detail. In the apparatus 10, first integrity calculation means 12 can be provided for this purpose, which can be implemented, for example, in the form of a special calculation unit in hardware or in software.

In the next step S14, a first position solution Pos1 is determined with the signals 340, 360, 380 and 400 received from all four satellites 34, 36, 28 and 40, ie including the signal 360 of the satellite 36 classified as having errors device 10 may be performed by first position determining means 14, which in turn may be implemented in hardware or software.

In step S16, a second position solution Pos2 is also determined without the signal 360 of the satellite 36 classified as having errors, ie only with the three signals 340, 380 and 400 of the satellites 34, 38 and 40, respectively. Also for the step S16 second position determining means 16 may be provided, which may be implemented in hardware or software.

Both the first and second position determining means 14 and 16 may be implemented by the controller mentioned above.

In step S18, a difference ΔPos is calculated from the two determined position solutions Pos1 and Pos2. This step may be performed by position difference calculating means 18 of the apparatus 10, which may be implemented in hardware or software.

The difference ΔPos is subtracted from the set alarm limit AL in step S20, so that a reduced alarm limit ALred is obtained. In order to carry out step S20, alarm barrier forming means 20 implemented in hardware or software may be provided in device 10.

Now, a second integrity risk PHMI (ALred) is calculated with the three satellites 34, 38 and 40 described by state 1 at the reduced alarm limit ALred in step S22, which may be performed by second integrity calculation means 22. The second integrity risk can again be determined according to the Galileo user integrity concept described in the introduction and described in the aforementioned publications.

In the following, the minimum of the two calculated integrity risks PHMI (AL) and PHMI (ALred) is determined. For this purpose, it is checked in step S24 whether the first integrity risk PHMI (AL) is greater than the second integrity risk PHMI (ALred). If so, the process proceeds to step S26 and the second integrity risk PHMI (ALred) is used to determine the integrity risk at the alarm gate. If the first integrity risk PHMI (AL) is less than the second integrity risk PHMI (ALred), then in step S28 the first integrity risk PHMI (AL) is used to determine the integrity risk at the alarm barrier. Steps D24, S26, and S28 may be performed by hardware or software implemented integrity risk averaging means 24 of device 10.

The smaller of the two integrity risks determined by the position determination device 26 can be output via output means, in particular displayed on a display device 28 such as an LCD display, via an audio output unit 32, for example as a warning tone and / or via a data output interface 30 for further processing by other devices or control of other devices. For example, satellite navigation based controls such as autopilot or pilot assistance systems or System for further processing of the determined position are influenced by the issued integrity risk. In particular, for example, automatic navigation may be discontinued if the integrity risk is too high, or navigation instruments based on satellite navigation may be switched over to operation that is independent of satellite navigation if the integrity risk is too high.

The present invention makes it possible to increase the availability of a position solution with a satellite navigation system with an integrity risk at an alarm gate by calculating the unweighted contribution to the integrity risk at the alarm barrier under the assumption that a satellite is faulty under two different assumptions and the minimum the two calculated contributions is used.

Reference Labels and Acrobones

10

Device for determining the integrity risk at an alarm barrier

12

first integrity calculation means

14

first position determining means

16

second position determining means

18

Position difference calculating means

20

Alarm barriers forming means

22

second integrity calculation means

24

Integrity risk determination means

26

Positioning device

28

display

30

Output data interface

32

Audio output unit

34

first satellite

340

first satellite signal

36

second satellite

360

second satellite signal

38

third satellite

380

third satellite signal

40

fourth satellite

400

fourth satellite signal

Claims (10)

1. A method for determining an integrity risk at an alert limit of a position solution determined by a satellite navigation system, wherein signals received from satellites of the satellite navigation system are processed for determining the position solution, the method comprising:

   - calculating a first integrity risk at the alert limit assuming that one satellite j of the satellites is faulty (S10, S12);

   - determining a first position solution is determined with signals received from all of the satellites (S14);

   - determining a second position solution with signals received from all of the satellites except for a signal received from the assumed faulty satellite j (S16);

   - determining a difference between the first and the second position solution (S18);

   - creating a reduced alert limit by subtracting the determined difference from the alert limit (S20);

   - calculating a second integrity risk at the reduced alert limit with the signals received from all satellites except the signal received from the assumed faulty satellite j (S22); and

   - determining the integrity risk at the alert limit using a lower of the first and second integrity risks (S24, S26, S28).
2. The method in accordance with claim 1,
   characterized in that
   the integrity risk at the alert limit is determined using the minimum of the first and second integrity risks as an unweighted contribution in accordance with a user integrity concept of a Galileo satellite navigation system.
3. The method in accordance with claim 1 or 2,
   characterized in that
   statistical descriptions provided by the satellite navigation system regarding signal errors of each satellite are processed and a basic error for an assumed faulty satellite is determined therefrom, and the basic error is evaluated as faulty for classification of a satellite.
4. The method in accordance with claim 3,
   characterized in that

   - an expected signal error or Signal in Space Accuracy SISA value for each satellite signal and

   - an accuracy of the estimate of the signal error or a Signal in Space Monitoring Accuracy SISMA value for each satellite signal

   are processed as statistical descriptions of signal errors for each satellite,
   wherein for each satellite the basic error TH is calculated according to the following equation: $$\mathit{TH}=k_{\mathrm{pfa}}\cdot \surd \left({\mathrm{SISA}}^{\mathrm{2}}+{\mathrm{SISMA}}^{\mathrm{2}}\right)$$

   

   wherein the prefactor k_pfa is determined by an allowed false alert rate.
5. A computer program having a program code for performing the method steps in accordance with the foregoing claims, when the computer program is run on a computer.
6. A medium for storing the computer readable program code of the computer program in accordance with claim 5.
7. An apparatus (10) for determining an integrity risk at an alert limit of a position solution determined by a satellite navigation system, wherein the apparatus is configured to process signals received from satellites of the satellite navigation system for determining the position solution, the apparatus comprising:

   - first means (12) configured to calculate a first integrity risk at the alert limit assuming that one satellite j of the satellites is faulty (S10, S12),

   - second means (14) configured to determine a first position solution is determined with signals received from all of the satellites (S14),

   - third means (16) configured to determine a second position solution with signals received from all of the satellites except for a signal received from the assumed faulty satellite j (S16),

   - fourth means (18) configured to determine a difference between the first and the second position solution (S18),

   - fifth means (20) configured to create a reduced alert limit by subtracting the determined difference from the alert limit (S20),

   - sixth means (22) configured to calculate a second integrity risk at the reduced alert limit with the signals received from all satellites except the signal received from the assumed faulty satellite j (S22), and

   - seventh means (24) configured to determine the integrity risk at the alert limit using a lower of the first and second integrity risks (S24, S26, S28).
8. The apparatus in accordance with claim 9,
   characterized in that
   the first through seventh means are at least partially implemented, by a programmable processor and a program stored in a memory for configuring the programmable processor, to perform one or more of the steps of the method in accordance with one of claims 1 to 4.
9. A position calculation device (26) configured to determine a position by signals of a satellite navigation system and to determine an integrity risk at an alarm limit for the determined position, wherein the position calculation device has an apparatus (10) in accordance with claim 7 or 8 and an output device (28, 30, 32) configured to output a determined integrity risk.
10. The apparatus in accordance with claim 9,
    characterized in that
    the output device is a display unit (28), a data output interface (30) and/or an audio output unit (32).

Images